Certified Defenses Against Image Transformations.
Following certificates for \(\ell _p\) -bounded perturbations, several methods proposed certified robustness against semantic perturbations. Generating linear relaxation and propagating through a neural network was used in [1]}, [2]}, [3]}. Extensions of MCMC-based randomized smoothing [4]} to the space of semantic transformations were presented in [5]}, [6]}, [7]}. Our work presents a probabilistic approach for certifying neural networks against different semantic perturbations. Perhaps, the closest to our approach are PROVEN [8]}, where authors present a framework to probabilistically certify neural networks against \(\ell _p\)  perturbations and work of [9]}, where authors certify a neural network in a probabilistic way by overapproximation of input regions that violate model's robustness. However, these works do not consider probabilistic certifications under semantic transformations.
